Stenographer

Stenographer is a full-packet-capture utility designed for buffering packets to disk for intrusion detection and incident response purposes. It offers high-performance NIC-to-disk packet writing, efficient disk management to handle file deletion as disk space fills up, and easy retrieval of specific packet sets. It excels in quickly writing packets to disk at speeds of around 10Gbps on multi-core, multi-disk systems, managing disk usage to store longer durations during traffic lulls, and deleting the oldest packets when reaching disk limits. However, it is not suitable for complex packet processing like TCP stream reassembly, as its focus on speed sacrifices such functionalities. Additionally, reading back large amounts of packets (>1% of packets written) can lead to disk read and write competition issues.